CVE-2026-20883
📋 TL;DR
This vulnerability allows users with revoked access to private Gitea repositories to still view issue titles and repository names through previously started stopwatches. It affects Gitea instances where users have had their repository permissions revoked while stopwatches were active. This is an improper access control issue that leaks limited repository metadata.
💻 Affected Systems
- Gitea
📦 What is this software?
Gitea by Gitea
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized users could enumerate private repository names and issue titles, potentially revealing sensitive project information or organizational structure.
Likely Case
Former collaborators or team members who lost access could still see repository names and issue titles they shouldn't have access to, violating access control policies.
If Mitigated
With proper monitoring and access revocation procedures, the impact is limited to metadata leakage rather than full repository access.
🎯 Exploit Status
Exploitation requires previously authenticated user sessions with active stopwatches before access revocation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.25.4
Vendor Advisory: https://github.com/go-gitea/gitea/security/advisories/GHSA-644v-xv3j-xgqg
Restart Required: Yes
Instructions:
1. Backup your Gitea instance and database. 2. Download Gitea 1.25.4 or later from official releases. 3. Stop the Gitea service. 4. Replace the Gitea binary with the new version. 5. Restart the Gitea service. 6. Verify the version is 1.25.4 or higher.
🔧 Temporary Workarounds
Stopwatch Cleanup
allManually clear all active stopwatches for users who have had repository access revoked
UPDATE stopwatch SET created_unix = 0 WHERE user_id IN (SELECT user_id FROM repository_access WHERE revoked = true)
🧯 If You Can't Patch
- Implement strict access revocation procedures that include terminating all active user sessions
- Monitor and audit stopwatch API access logs for unauthorized repository metadata requests
🔍 How to Verify
Check if Vulnerable:
Check if Gitea version is below 1.25.4 and if users with revoked repository access can still access stopwatch API endpoints for those repositoriesCheck Version:
./gitea --versionVerify Fix Applied:
After upgrading to 1.25.4+, verify that users with revoked access cannot access stopwatch API endpoints for private repositories📡 Detection & Monitoring
Log Indicators:
- API requests to /api/v1/repos/{owner}/{repo}/stopwatch from users who shouldn't have repository access
- Stopwatch-related API calls returning repository metadata for users with revoked permissions
Network Indicators:
- Unusual patterns of stopwatch API requests to private repositories
SIEM Query:
source="gitea.log" AND ("stopwatch" OR "/api/v1/repos/") AND response_code=200 AND user_id IN (SELECT user_id FROM revoked_access_list)